[MTGDarkness]

He gave me this example:

Ok here is a quick one.

Custom Sigs accept code, you could cross script it and send to the admin, that wuld cause the admin to load a page to change his pass and send it to you.

Or you could steal his cookie.

Of you could have him execute delete from on his entire db.

So all you do is mail the ++++ and let your custom kill him.

(code so he can't see it)